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BSA SUBMISSION TO THE REPUBLIC OF KOREA ON KOREA- 
SINGAPORE DIGITAL PARTNERSHIP AGREEMENT 


Overview 


BSA | The Software Alliance (BSA)' seeks to provide comments to the Ministry of Trade, Industry 
and Energy (MOTIE) on the substantially concluded Korea-Singapore Digital Partnership 
Agreement (KSDPA). BSA understands that MOTIE is presently conducting public consultations 
on the KSDPA and would like to voice our support for the KSDPA’s signing and entry into force. 


Our key messages are as follows: 


1. The digital trade provisions in the KSDPA, notably binding rules prohibiting unwarranted 
restrictions on cross-border data transfers and requirements to localize computing 
facilities, will yield tangible benefits for Korean businesses. 


2. Unfortunately, the KSDPA’s prohibition on location of computing facilities does not apply 
to financial institutions/service suppliers. Requiring financial institutions/service suppliers 
to localize their computing facilities and data may hamper regulatory oversight and create 
security concerns. 


Introduction 


BSA is the leading advocate for the global software industry before governments and in the 
international marketplace. BSA’s members are at the forefront of the data-driven innovation that 
is fueling global economic growth and recovery, including through cutting-edge advancements in 
cloud computing, security solutions, artificial intelligence (Al) and machine learning, and the 
Internet of Things (loT). BSA member companies provide software solutions to enterprise 
customers, and as such they understand the critical importance of robust policies that facilitate 
digital trade and trusted data flows. 


BSA congratulates Korea on the substantial conclusion of the KSDPA. The KSDPA is a forward- 
looking, comprehensive Digital Economy Agreement (DEA), and an important step in building a 
global consensus on new rules for the digital economy. These rules are critical to job creation, 
economic competitiveness, and software-enabled innovations such as cloud computing, Al, smart 
devices, and other emerging technologies. They also reflect the transformative role of technology 
and data in growing economies and raising competitiveness across a wide range of industries. 
BSA and its members are therefore strongly supportive of DEAs, such as the KSDPA. 


1 BSA’s members include: Adobe, Alteryx, Altium, Amazon Web Services, Atlassian, Autodesk, Aveva, Bentley Systems, Box, 
Cisco, CNC/Mastercam, Dassault, DocuSign, Dropbox, IBM, Informatica, Intel, MathWorks, Microsoft, Nikon, Okta, Oracle, PTC, 
Rockwell, Salesforce, SAP, ServiceNow, Shopify Inc., Siemens Industry Software Inc., Splunk, Trend Micro, Trimble Solutions 
Corporation, Twilio, Unity Technologies, Inc., Workday, Zendesk, and Zoom Video Communications, Inc. 
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How the KSDPA will benefit Korean businesses 


Korea is one of the fastest digitalizing economies in the world.? For example, Korea’s public cloud market 
is expected to double in size from USD1.5 billion in 2018 to USD3.1 billion in 2023, which will generate 
an estimated USD45 billion in national GDP and approximately 50,000 jobs. While digital native 
businesses, such as e-commerce platforms and gaming companies, are drivers of digitalization, there is 
increasing traction from retail players and large conglomerates as they seek to support their digital arms 
and expand businesses internationally.4 Indeed, from healthcare and manufacturing to agriculture and 
retail, digital technologies are becoming an integral part of how companies design, create, and export 
new products and services; enhance business processes and increase productivity; reach new 
customers; manage their supply-chain and engage in research and development.® 


Unfortunately, trade barriers and digital protectionism are growing around the world at the very time that 
digital trade and connectivity are helping to sustain economic activity, employment, and social well-being. 
The World Trade Organization (WTO) has reported that some 80 countries have imposed export and 
other trade restrictions in reaction to the COVID-19 epidemic, in addition to a growing number of digital 
trade barriers that impact the movement of data and information across borders.® 


The requirement to store data within a country’s borders, coupled with restrictions on international data 
transfers, present serious challenges for businesses of all kinds, which can undermine Korea’s economic 
competitiveness in the global digital economy. Data localization requirements create unnecessary costs, 
difficulties, and uncertainties that hamper business and investments in the following ways: 


e prevent local businesses from accessing new and innovative technologies, which may 
consequently preclude participation in global supply chains and access to customers in foreign 
markets; 


e prevent local businesses from using data analytics to drive R&D in emerging technologies that 
are heavily reliant on large datasets, such as Al and machine learning; 


e reduce Korea’s attractiveness as a destination for investment and R&D, as foreign investors will 
need to incur significant costs duplicating their processing and storage facilities locally; and 


e result in potential conflict of laws as other countries may impose contradictory requirements 
regarding the movement of data across borders. 


The KSDPA addresses these concerns by imposing binding rules on the movement and localization of 
data: 


e Article 14.14 (Cross-Border Transfer of Information by Electronic Means) stipulates that “neither 
Party shall prohibit or restrict the cross-border transfer of information by electronic means, 
including personal information, if this activity is for the conduct of business of a covered 
person”. 


e Article 14.15 (Location of Computing Facilities) prohibits the Parties from imposing 
requirements “to use or locate computing facilities in that Party’s territory as a condition for 
conducting business in that territory”. 


The KSDPA will further benefit Korean businesses in the following ways: 


2 Korea has topped the Bloomberg Innovation Index for seven of the last nine years. See: 
https://www.bloomberg.com/news/articles/2021 -02-03/south-korea-leads-world-in-innovation-u-s-drops-out-of-top- 





10?sref=d80B8qmA. 


3 BCG, “Ascent to the Cloud: How Six Key APAC Economies can Lift-Off’, October 2019, https://web-assets.bcg.com/img- 
src/Ascent to the Cloud Report 21Oct_tcm9-231826.pdf (BCG Report). 


* BCG Report (2019). 





5 Global Data Alliance, “Jobs in every sector depends upon data flows”, March 2020, hitps://globaldataalliance.org/wp- 
content/uploads/2021/07/infographicgda.pdf. 


® World Trade Organisation Report 2021, https://www.wto.org/english/res_e/booksp e/wtr21_ e/00 wtr21_e.pdf 
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e Prohibition of Customs duties on electronic transmissions: The KSDPA prohibits the 
imposition of customs duties on electronic transmissions, including on content transmitted 
electronically. BSA strongly supports this position, as imposing customs duties on electronic 
transmissions would drive up the costs of conducting trade and interrupt cross-border access to 
knowledge and digital tools, which are detrimental to businesses. 


e Mutual recognition and interoperability for electronic signature, authentication, 
electronic contracts, electronic invoicing and digital identity frameworks: These are 
important provisions that will break down barriers to digital trade by reducing unnecessary and 
outdated processes. They will also support individuals and businesses in Korea by allowing 
them to conduct business quickly and securely with customers and partners in Singapore. 


e Interoperability of personal information protection regimes. Privacy and security are 
bedrock principles for the digital economy and international interoperability will provide a safe 
digital trading environment for both consumers and businesses. 


e Prohibition on access to or disclosure of source code: Companies can rest assured that 
they will not be required to disclose, transfer or provide access to the source code of their 
products as a condition for the import, distribution, sale or use of such products. 


e Cooperation on data innovation: Korea and Singapore will explore the possibility of 
collaborating on data-sharing projects through regulatory sandboxes. Businesses can leverage 
on the opportunities provided to explore and develop new products and services from data- 
driven innovations. 


e Open Government Data: BSA commends the addition of a provision on open government 
data. Government-generated data can serve as a powerful economic driver, promoting 
economic growth and enabling innovation. 


Concerns regarding location of computing facilities for financial 
institutions/service suppliers 


Despite the binding rules on cross-border transfer of data and location of computing facilities, BSA notes 
that the KSDPA’s prohibition on computing facility localization does not apply with respect to a “financial 
institution” or a “financial service supplier of a Party”.’ In other words, financial institutions and service 
suppliers from Singapore may be required to use or locate their computing facilities in Korea as a 
condition for conducting business in Korea, and vice versa. 


BSA recognizes that regulatory authorities in the financial sector require immediate and ongoing access 
to information of financial institutions and service suppliers, including information underlying their 
transactions and operations, to discharge their supervisory and monitoring duties. 8 It is a common 
concern among financial regulatory authorities that their ability to access financial data may be 
hampered if such data was stored outside of the country. Localization measures are thus seen as the 
solution for financial regulatory authorities seeking to maintain access to financial data. 


However, requiring financial institutions/service suppliers to localize their computing facilities 
and data may increase security risks. As the capabilities of malicious actors in cyberspace continue to 
evolve, investments in data security have increased. This is especially so for the financial sector, where 
the effects of a cyberattack can be devastating. However, localization measures often compel financial 
institutions and service suppliers to use local data storage service providers in the country that imposes 
such measures. This by definition limits the options of such financial institutions and service providers 
when deciding where and with what entities they wish to entrust their data, including the option of using 
their own centralized data storage and processing centers, or those provided by third party service 
providers that may not have data centers in country. Local data storage service providers may not have 
the same security capabilities as global counterparts, many which invest enormous amounts of 


7 KSDPA, Article 14.15 (4) 
8 KSDPA, Article 14.16 (2) 
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resources in their cybersecurity capabilities and constantly upgrade their security programs and controls 
to deal with the latest cyber threats. Delays in uploading threat incident information to cybersecurity 
companies’ global networks due to regional data restrictions could also expose customers in that region 
to new threats spreading from other parts of the world, reducing information privacy and security for 
those customers. Information sharing across jurisdictions could also be limited, undermining efforts from 
both financial institutions/service suppliers and regulatory authorities to combat money-laundering and 
financing of terrorism. 


Localization requirements in the financial sector are also not necessary for regulatory oversight. 
In a globalized economy, financial institutions and service suppliers often must provide services 
internationally to their customers in other countries, requiring the international transfer of significant 
amounts of financial data daily. Regulators have several mechanisms to ensure that they may maintain 
access to necessary data from financial institutions and service suppliers regardless of where the data 
may be stored, such as entering contractual agreements with financial institutions/service suppliers to 
have immediate and ongoing access to information processed or stored on computing facilities out of the 
country. As a general principle, there is no reason to impose localization requirements on financial 
institutions/service suppliers if regulatory authorities have immediate and ongoing access to their data. 
This is the approach taken in Singapore’s DEAs with both Australia and the United Kingdom 
(UK), which BSA strongly supports: 


e Inthe Singapore-Australia DEA, Article 25(2) states that neither Party shall require a financial 
institution/services supplier to localize their computing facilities and data, so long as financial 
regulatory authorities “have immediate, direct, complete and ongoing access” to the information 
processed or stored on computing facilities used by the financial institution/service supplier 
located out of the country. 


e Similarly, the UK-Singapore DEA amends Article 8.54 of the UK-Singapore Free Trade 
Agreement to state that a Party may only impose localization measures on a financial service 
supplier if it is “not able to ensure appropriate access to information required for the purposes of 
financial regulation and supervision”. The Article further requires the Party imposing the 
localization measure to: (1) provide the financial service supplier “a reasonable opportunity to 
remediate any lack of access to information”; and (2) to consult with the other Party’s regulatory 
authorities before imposing the localization measure. 


The United States-Singapore Joint Statement on Financial Services Data Connectivity? is also a useful 
reference point. While non-binding in nature, both countries agreed to: 


e Ensure that financial service suppliers can transfer data, including personal information, across 
borders by electronic means if this activity is for the conduct of the business of a financial 
service supplier. 


e Oppose measures that restrict where data can be stored and processed for financial service 
suppliers as long as financial regulators have full and timely access to data needed to fulfill 
their regulatory and supervisory mandate. 


e Ensure that financial service suppliers have the opportunity to remediate the lack of access to 
such data before being required to use or locate computing facilities locally. 


BSA urges Korea to work towards the high watermark set by the Singapore-Australia and UK- 
Singapore DEAs in its future DEAs. We also urge Korea’s financial regulatory authorities to 
collaborate closely with their Singaporean counterparts, including through non-binding joint 
statements or Memorandums of Understanding, so that this issue may be addressed in future 
upgrades to the KSDPA. 


Conclusion 


BSA once again congratulates MOTIE and the Korean government on successfully concluding the 


° United States-Singapore Joint Statement on Financial Services Data Connectivity, February 2020, 
https:/www.mas.gov.sg/news/media-releases/2020/united-states-singapore-joint-statement-on-financial-services-data-connectivity 
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KSDPA with Singapore. We look forward to working and collaborating with Korea on advancing 
international norms in digital trade. If you require any clarification or further information in respect of 
this submission, please contact the undersigned at shenhongt@bsa.org . 


Sincerely, 
Tarm Sen Kong 


Tham Shen Hong 
Manager, Policy - APAC 
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